Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357

Original title: CISA KEV: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability — Ivanti Connect Secure (CVE-2026-111357)

CISA Known Exploited Vulnerabilities ()1 min read
Read at cisa.gov
Part of a story covered by 4 sourcesIvanti Connect Secure zero-days chained for root, added to CISA KEVMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.

CISA’s KEV entry for CVE-2026-111357 says Ivanti Connect Secure is missing authentication for a critical function, letting a local authenticated attacker escalate privileges. The entry says the flaw can be chained with CVE-2026-104935 and CVE-2026-118527. Required action is vendor mitigations, BOD 26-04, and CISA forensics triage, with a due date of November 2, 2026. Known ransomware campaign use is listed as unknown.

Unconfirmed: Known ransomware campaign use is listed as unknown, and chaining in real attacks is not confirmed.

Key facts
  • Due date is November 2, 2026.
  • It can be chained with CVE-2026-104935 and CVE-2026-118527.
  • Known ransomware campaign use is unknown.
  • Discontinue the product if mitigations are unavailable.
Security assessment · AI, from the articleExploited in the wild

Impact: Local authenticated attacker can escalate privileges.

ProductAffected
Ivanti Connect Secure—
What to do
  1. 1.Apply mitigations according to Ivanti’s instructions.
  2. 2.Follow BOD 26-04 and CISA forensics triage requirements.
  3. 3.Discontinue use if mitigations are unavailable.
Analyze CVE-2026-111357 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111357
ATT&CK
T1068 Exploitation for Privilege Escalation
Tags
ivanticonnect-securekevprivilege-escalationcisa
Vendors
Ivanti
Products
Ivanti Connect Secure
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111357
Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
7.0<1%KEV
KEV

From the original article

1 min read at cisa.gov

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.